Skip to content

lib-index: mail-index-strmap - Fix OOB read from truncated record size - #304

Open
nishat-06 wants to merge 1 commit into
dovecot:mainfrom
nishat-06:strmap-rec-size-truncation
Open

lib-index: mail-index-strmap - Fix OOB read from truncated record size#304
nishat-06 wants to merge 1 commit into
dovecot:mainfrom
nishat-06:strmap-rec-size-truncation

Conversation

@nishat-06

Copy link
Copy Markdown
Contributor

Truncated record size in mail_index_strmap_read_rec_first over-reads the block

A crafted or corrupted dovecot.index.thread strmap record can pick a packed count where the record byte size count * (sizeof(str_idx) + sizeof(crc32)) overflows the 32-bit rec_size field: with n=0x20000001 the size 0x100000008 truncates to 8, so i_stream_read_bytes(input, ..., rec_size) accepts a tiny block while the code still walks str_idx_base = data + count*sizeof(uint32_t) forward by ~2 GiB and reads count records past it. Widening rec_size to size_t keeps the real byte count, so an oversized record fails the stream read and is rejected as corruption, which is how the sibling doveadm-dump-thread.c path already treats the same quantity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant